Free Microsoft Certified: Azure Administrator Associate (AZ-104) Sample Questions

Correct answer: C — A CSV file using the Bulk Create User template

• A. Incorrect. The bulk user creation feature in the Azure portal exclusively uses the Comma-Separated Values (CSV) file format. XML is not a supported file type for this operation.
• B. Incorrect. While the file format (CSV) is correct, the 'Bulk Invite User' template is specifically for inviting external guest users (B2B collaboration) to the tenant, not for creating new internal member user accounts.
• C. Correct. The 'Bulk create users' operation in the Azure portal requires a Comma-Separated Values (CSV) file. You must use the 'Bulk Create User' template, which can be downloaded directly from the Microsoft Entra admin center, populated with the user details, and then uploaded to create the users in bulk.
• D. Incorrect. The Azure portal's bulk user creation functionality does not support JSON files. The only supported format for this task through the portal is CSV.

Correct answer: C — You cannot restore User1 because the 30-day soft-delete period has expired.

• A. Incorrect. The user cannot be restored because the 30-day soft-delete period has expired. The user was deleted on January 1, and the restore attempt on February 5 is beyond the 30-day window. While a successful restore within the period would retain group memberships, the restore is not possible in this case.
• B. Incorrect. This is incorrect for two reasons. First, the user cannot be restored as the 30-day retention period has passed. Second, if a user were successfully restored within the 30-day window, their group memberships would also be restored, and manual re-addition would not be necessary.
• C. Correct. Microsoft Entra ID places deleted users into a soft-deleted state for a 30-day period. Since the user was deleted on January 1, the restoration window closed around January 31. The attempt on February 5 is outside this 30-day period, meaning the user has been permanently deleted and cannot be restored.
• D. Incorrect. Although the conclusion that the user cannot be restored is correct, the reason is wrong. The soft-delete retention period for Microsoft Entra users is 30 days, not 14 days.

Correct answers: A, C — Virtual Machine Contributor; Support Request Contributor

• A. Correct. The Virtual Machine Contributor role grants permissions to manage virtual machines, including actions like starting, stopping, and restarting. It does not grant access to other resource types, thereby adhering to the principle of least privilege for the VM management requirement.
• B. Incorrect. The Owner role provides full access to manage all resources within a scope, including the ability to delegate permissions. This grants far more privileges than required and is a clear violation of the principle of least privilege.
• C. Correct. The Support Request Contributor role is specifically designed to allow users to create and manage support tickets without granting any permissions to manage other Azure resources. This is the least-privilege role for fulfilling the support ticket requirement.
• D. Incorrect. The Contributor role provides broad permissions to manage all types of Azure resources within a scope (except for managing access). This is far too permissive for the specific tasks of restarting VMs and creating support tickets, thus violating the principle of least privilege.
• E. Incorrect. The Reader role provides read-only access to Azure resources. It does not grant any permissions to perform actions like restarting a virtual machine or creating a support ticket.

Correct answer: B — There is a Deny Assignment applied by an Azure Blueprint or Managed Application.

• A. Incorrect. The 'Reader' role is sufficient to view Azure resources, including an Azure SQL Database. The 'SQL DB Contributor' role grants permissions to manage the database, which is not required for read-only viewing in the portal.
• B. Correct. Deny assignments take precedence over regular 'Allow' role assignments. If a Deny Assignment exists, often applied by Azure Blueprints or Managed Applications to lock down resources, it will block access even if the user has a role like 'Reader' that would otherwise grant it. This is the most likely reason for an explicit permission grant not working as expected.
• C. Incorrect. This statement is factually wrong. The primary purpose of the 'Reader' role is to grant read-only access to view resources within its assigned scope in the Azure portal.
• D. Incorrect. While role assignment propagation can sometimes be delayed, requiring a token refresh (by logging out and back in), this is typically a transient issue. A Deny Assignment is a more definitive and persistent reason for being unable to access a resource, making it the most likely cause.

Correct answer: B — False

• A. The statement is false. The proposed solution does not meet the goal. The Contributor role in Azure allows for managing most resources but explicitly excludes the ability to manage access control. The permission required to assign roles, `Microsoft.Authorization/roleAssignments/write`, is not included in the Contributor role.
• B. The statement is true. The proposed solution fails to meet the goal. To allow a user to assign roles to others, they must be granted a role that includes the `Microsoft.Authorization/roleAssignments/write` permission. The built-in roles that have this permission are Owner and User Access Administrator. Since the Contributor role lacks this permission, assigning it to User1 is insufficient.

Correct answer: B — Apply a CanNotDelete lock to 'CriticalVM'.

• A. Incorrect. The User Access Administrator role grants permissions to manage user access to Azure resources (i.e., assign roles to others). It does not directly provide or prevent permissions to manage the resources themselves and does not prevent deletion. An administrator with this role could potentially grant themselves a role with delete permissions.
• B. Correct. A 'CanNotDelete' lock is the appropriate tool for this scenario. It specifically prevents the deletion of a resource while still permitting all other read and update (write) operations. Restarting and resizing a virtual machine are considered update operations, so administrators would still be able to perform these actions as required.
• C. Incorrect. A 'ReadOnly' lock prevents all write operations, including deletion, modification, and even actions like restarting or resizing the VM. This lock is too restrictive as it would block the required administrative tasks of restarting and changing the VM's size.
• D. Incorrect. While Deny assignments can block specific actions, they are a more complex and broader governance mechanism, typically applied as part of Azure Blueprints or for managed applications to enforce organizational policies. A resource lock is a much simpler, more direct, and standard method for preventing accidental deletion of a single, specific resource.

Correct answer: B — False

• A. The statement is false. The proposed solution does not meet the goal. Azure RBAC roles, including the `Actions` and `NotActions` properties, control permissions for management operations (e.g., `Microsoft.Compute/virtualMachines/write`). These operations are not inherently location-specific within the role definition itself. You cannot use a `NotAction` to exclude specific Azure regions.
• B. The statement is true. The proposed solution is incorrect because RBAC roles do not control resource properties like location. The correct tool for this requirement is Azure Policy. By creating and assigning an 'Allowed locations' policy, you can enforce a rule that only permits resource creation in specified regions like 'West US' and 'East US'. Attempts to create resources elsewhere would be denied by the policy.

Correct answer: C — Copy the previous version of the blob over the current version.

• A. This method is incorrect and inefficient. While functionally possible, it involves unnecessary steps of downloading and re-uploading. More importantly, the option refers to a 'snapshot', which is a distinct feature from Blob Versioning. The correct method with versioning is a direct server-side operation.
• B. This is incorrect. The 'Undelete Blob' operation is used to restore blobs that have been soft-deleted. In this scenario, the blob was modified, not deleted, so this operation is not applicable.
• C. This is the correct procedure. With Blob Versioning enabled, previous versions of a blob are preserved. To revert to a prior state, you can copy a specific previous version over the current (base) blob. This action effectively promotes the older version, making its content the current version of the blob.
• D. This is incorrect. Changing the access tier to Archive is a storage management action that affects the blob's availability, retrieval time, and cost. It does not alter the content of the blob or revert it to a previous version.

Correct answer: A — Delete the 'policy1' Stored Access Policy.

• A. Correct. A SAS token associated with a stored access policy is validated against that policy upon each use. Deleting the stored access policy immediately breaks the link, causing any authentication attempts with SAS tokens referencing that policy to fail. This is the most direct and effective way to revoke all associated SAS tokens at once.
• B. Incorrect. A key advantage of using a stored access policy is that the SAS tokens referencing it are not dependent on the storage account access keys. Regenerating the account keys invalidates ad-hoc SAS tokens (those not using a policy), but it does not affect SAS tokens associated with a stored access policy.
• C. Incorrect. Similar to regenerating the primary key, regenerating the secondary access key does not revoke SAS tokens that are bound to a stored access policy. The validity of these specific SAS tokens is tied to the policy, not the account keys.
• D. Incorrect. A SAS token is an immutable signed string. Once it has been generated and distributed, it cannot be modified. While you can modify the *stored access policy* itself (e.g., by changing its start or expiry time to invalidate tokens), you cannot change the tokens that have already been issued.

Correct answer: C — Create a Stored Access Policy on the file share.

• A. Incorrect. An ad-hoc Service SAS (one created without a stored access policy) cannot be revoked before its expiration date without regenerating the storage account key it was signed with. This directly violates the requirement to revoke access without regenerating keys.
• B. Incorrect. A User Delegation SAS is secured with Azure AD credentials instead of the storage account key, which is a security best practice. However, User Delegation SAS is only supported for Azure Blob storage and Azure Data Lake Storage Gen2, not for Azure File shares. Therefore, it is not a valid solution for this scenario.
• C. Correct. A Stored Access Policy provides server-side control over Service SAS tokens. By first creating a policy on the file share with the required permissions (Read, List) and validity period (7 days), you can then create a Service SAS that references this policy. This method allows you to modify permissions or revoke access instantly by simply changing or deleting the policy, fulfilling the requirement to manage access without regenerating the storage account keys.
• D. Incorrect. Using a storage account access key is highly insecure as it provides full administrative permissions to the entire storage account, not just Read/List on a specific file share. Access keys do not have an expiration date and can only be revoked by regenerating the key, which also violates a specific requirement of the scenario.

Correct answer: A — True

• A. The statement is true. Enabling the 'Secure transfer required' property on a storage account enforces that all incoming requests are made over a secure, encrypted connection. For REST API endpoints (Blob, Queue, Table, File), this means requests must use HTTPS. For Azure Files access via the SMB protocol, it requires SMB 3.0 or later with encryption. Any unencrypted requests, such as those over HTTP or SMB without encryption, will be rejected, thus meeting the goal.
• B. The statement is false. The proposed solution does meet the goal. The 'Secure transfer required' setting is the primary mechanism within Azure Storage to enforce encryption for all data in transit, covering both REST API (via HTTPS) and SMB traffic (via SMB 3.0+ with encryption).

Correct answers: B, D — Blob versioning; Change feed

• A. Incorrect. Point-in-time restore is a data protection feature that allows you to restore a storage account to a previous state. While it relies on blob versioning, soft delete, and change feed, it is not itself a prerequisite for configuring object replication.
• B. Correct. Blob versioning is a mandatory prerequisite for object replication. It must be enabled on both the source and the destination storage accounts. Object replication relies on blob versions to track and replicate changes from the source to the destination.
• C. Incorrect. Soft delete for blobs is an optional data protection feature that protects blobs from accidental deletion. It is not a requirement to enable object replication.
• D. Correct. The change feed provides a transactional log of all changes to the blobs in the storage account. It is a mandatory prerequisite on the source account for object replication to function. While it is only strictly required on the source, it is a best practice to also enable it on the destination to support failover scenarios, making it a key requirement for a robust replication configuration.
• E. Incorrect. Immutability policies are used to configure Write-Once, Read-Many (WORM) policies for compliance and data retention. They are not a prerequisite for setting up object replication.

Correct answers: A, B, C — Blob index match; Prefix match; Blob versions

• A. Correct. Blob index match is a supported filter that allows you to apply lifecycle management rules only to blobs that have specific key-value index tags. This provides a more granular way to target blobs for lifecycle actions.
• B. Correct. Prefix match is a common filter used to scope a rule to a specific container or a set of blobs within a container that share a common prefix (similar to a folder structure).
• C. Correct. Lifecycle management rules can be configured to specifically include and manage blob versions. This allows you to create policies for transitioning or deleting older versions of a blob, which is essential for managing storage costs when versioning is enabled.
• D. Incorrect. File share name is a concept related to Azure Files, not Azure Blob Storage. Lifecycle management rules apply to block blobs and append blobs within a storage account, not file shares.
• E. Incorrect. While you can set metadata on containers, it cannot be used as a filter for lifecycle management rules. The available filters are prefix match, blob index match, and blob types.

Correct answer: A — True

• A. The statement is true because when a customer-managed account failover is performed on a GRS or RA-GRS account, the secondary endpoint becomes the new primary endpoint. After the failover, the account is reconfigured to be Locally-Redundant Storage (LRS) in the new primary region. Geo-replication is broken, and it is a manual process to reconfigure the account back to GRS to establish a new secondary region.
• B. The statement is false because the outcome described in the proposed solution is accurate. A failover of a GRS account does result in the new primary account having an LRS configuration. The original geo-redundant replication is not preserved after the failover.

Correct answer: D — Cold

• A. Incorrect. The Hot tier is optimized for data that is accessed frequently. It has higher storage costs compared to the Cool and Cold tiers, making it unsuitable for rarely accessed backup data where cost minimization is a priority.
• B. Incorrect. The Cool tier is designed for data that is infrequently accessed and stored for at least 30 days. While it offers lower storage costs than Hot, the Cold tier provides even lower storage costs for data with very infrequent access (e.g., every 90 days or more), making Cool not the lowest-cost option for this scenario.
• C. Incorrect. The Archive tier is intended for data that is rarely accessed and can tolerate high latency retrieval (hours). It does not provide immediate access; data must be rehydrated before reading, which can take hours. This conflicts with the requirement for immediate access during restoration drills.
• D. Correct. The Cold tier is an online tier optimized for data that is infrequently accessed but requires immediate availability. It offers the lowest storage costs among online tiers (lower than Cool) and is suitable for backup data accessed every six months, as it provides immediate access without rehydration delays. Per Azure documentation, the Cold tier is designed for data that is accessed less frequently than Cool tier data (e.g., every 90 days or more) and still requires fast retrieval.

Correct answer: B — Deploy VM1 to East US Zone 1 and VM2 to East US Zone 2.

• A. Incorrect. Placing two or more virtual machines in the same Availability Set protects them from hardware failures (Fault Domains) and planned maintenance (Update Domains) within a single datacenter. This configuration provides an SLA of 99.95%, which does not meet the 99.99% requirement.
• B. Correct. Deploying virtual machines across two or more Availability Zones within the same Azure region provides protection against entire datacenter failures. Availability Zones are physically separate locations with independent power, cooling, and networking. This configuration is what Azure offers for a 99.99% VM availability SLA.
• C. Incorrect. Deploying VMs to different regions (e.g., East US and West US) is a disaster recovery strategy, not a high-availability configuration for a single application's SLA. The Azure VM SLA is defined for configurations within a single region (using Availability Sets or Availability Zones). While a cross-region deployment can be highly available, it doesn't align with the specific 99.99% VM uptime SLA offered by Azure.
• D. Incorrect. A Virtual Machine Scale Set (VMSS) can provide high availability, but specifying a single fault domain (FD=1) means all instances could be placed on the same underlying hardware rack. This configuration offers no protection from hardware failures and thus does not provide the redundancy required for a high-availability SLA.

Correct answer: B — Decrease the scale-in threshold to a lower value (e.g., 50%).

• A. Incorrect. While increasing the scale-out threshold to 90% would create a wider gap between the scale-out (90%) and scale-in (70%) thresholds, it is not the recommended approach. This change would delay necessary scaling actions until CPU load is very high, potentially causing performance degradation for your application. The primary issue is the small difference between the two thresholds, which is better addressed by modifying the scale-in value.
• B. Correct. The flapping, or oscillation, is caused by the scale-out threshold (75%) and scale-in threshold (70%) being too close together. Decreasing the scale-in threshold to a lower value, such as 50%, creates a significant gap or 'hysteresis'. This ensures that after a scale-out event, the system's load must decrease substantially before a scale-in event is triggered, effectively preventing the rapid cycle of adding and removing instances.
• C. Incorrect. The cool-down period is a duration after a scaling operation during which no further scaling actions are initiated. This feature is designed to prevent flapping. Reducing the cool-down period would allow the scale set to react more quickly to metric changes, which would likely exacerbate the flapping issue rather than resolve it. To help mitigate flapping, one would typically increase, not decrease, the cool-down period.
• D. Incorrect. The aggregation type (e.g., Average, Minimum, Maximum, Total) determines how the metric data from all instances is combined into a single value to be evaluated. Changing the aggregation type does not address the root cause of the flapping, which is the insufficient gap between the scale-out and scale-in thresholds.

Correct answer: C — KEDA (Kubernetes Event-driven Autoscaling)

• A. Incorrect. Azure Monitor Autoscale is a platform feature used for scaling resources like Virtual Machine Scale Sets, App Service Plans, and other PaaS services based on performance metrics like CPU or memory utilization. It is not the mechanism used by Azure Container Apps for event-driven scaling based on queue length.
• B. Incorrect. Virtual Machine Scale Sets (VMSS) are an Azure IaaS feature for creating and managing a group of identical, load-balanced VMs. Azure Container Apps is a serverless container platform that abstracts the underlying infrastructure, and it does not use VMSS for application-level, event-driven scaling.
• C. Correct. Azure Container Apps is built on Kubernetes and natively integrates KEDA (Kubernetes Event-driven Autoscaling) to manage event-driven scaling. KEDA provides specific scalers that monitor event sources, such as the number of messages in an Azure Service Bus queue, and automatically scales the number of container replicas up or down in response.
• D. Incorrect. Dapr (Distributed Application Runtime) provides building blocks and APIs to simplify building resilient, stateful microservices. While Dapr can be enabled within an Azure Container App to facilitate application development (e.g., for pub/sub messaging or state management), it is not the component responsible for the infrastructure-level task of autoscaling container replicas. That function is handled by KEDA.

Correct answer: B — False

• A. The statement is false. Although an Azure Kubernetes Service (AKS) cluster can technically run a containerized task using a Job object, this approach fails to meet the stated goals. Creating and managing an entire cluster introduces significant administrative overhead and cost, making it an inappropriate choice for a single, short-lived task.
• B. The statement is true. The proposed solution does not meet the goal because provisioning an entire AKS cluster for a single 5-minute task is excessive in terms of both administrative effort and cost. A much more suitable and cost-effective service for this scenario is Azure Container Instances (ACI), which is designed for running individual containers without managing any underlying infrastructure.

Correct answer: B — A Shared Access Signature (SAS) token

• A. Incorrect. A storage account access key provides full, unrestricted administrative access to the entire storage account, which is highly insecure for this purpose. Furthermore, access keys are not designed to be appended to a resource URI; the ARM deployment engine does not support this method for authentication.
• B. Correct. A Shared Access Signature (SAS) token is the standard and secure method for providing delegated, time-limited, and permission-scoped access to resources in a private storage container. By generating a SAS token and appending it to the blob's URI, you grant the ARM deployment engine the necessary permissions to securely download and process the linked template without exposing the storage account's keys.
• C. Incorrect. While Managed Identities are used for authentication between Azure services, a Client ID is not something you append to a URI to grant access to a file. Accessing a linked template using a managed identity would require a different authentication flow and is not achieved by modifying the URI with a client ID.
• D. Incorrect. A Service Principal Secret is a credential used for application authentication, typically within an OAuth 2.0 flow to acquire an access token. It is highly sensitive and should never be exposed by appending it to a URI. The ARM deployment engine does not support this method for retrieving linked templates.

Correct answers: A, C — targetScope = 'subscription'; resource policy 'Microsoft.Authorization/policyDefinitions@2020-09-01'

• A. Correct. To change the deployment scope from the default of `resourceGroup` to the subscription level, the `targetScope = 'subscription'` directive is mandatory. This line must be placed at the top of the Bicep file, outside of any resource, parameter, or variable declarations.
• B. Incorrect. The `scope` property is used on a resource or module declaration to deploy that specific item to a scope different from the file's `targetScope`. It is not a valid top-level directive for setting the overall deployment scope.
• C. Correct. A Bicep file intended for deployment must declare at least one resource. This line correctly declares a resource of type `Microsoft.Authorization/policyDefinitions`, which is a resource deployed at the subscription scope and matches the example provided in the question.
• D. Incorrect. While a resource group is a resource deployed at the subscription level, the file must contain *a* resource definition, but not necessarily this specific one. Given the example in the question (Policy Definitions), the declaration for a policy definition is the more appropriate answer.
• E. Incorrect. The deployment mode (`Complete` or `Incremental`) is not a setting within the Bicep file itself. It is a parameter specified when you execute the deployment command using tools like Azure PowerShell (`-Mode Complete`) or Azure CLI (`--mode Complete`).

Correct answer: B — Scale up ASP1 to the Standard tier

• A. Incorrect. Scaling out increases the number of VM instances running the app within the same pricing tier. This improves performance and scalability but does not unlock features available in higher tiers. Deployment slots are a feature that is dependent on the App Service plan tier, not the instance count.
• B. Correct. The deployment slots feature is not available in the Free, Shared, or Basic pricing tiers of Azure App Service. To use deployment slots, the App Service plan must be running in the Standard, Premium, or Isolated tier. Therefore, the first step is to scale up the App Service plan ASP1 from the Basic tier to at least the Standard tier.
• C. Incorrect. Configuring a custom domain is an independent action used to map a custom DNS name (e.g., www.yourcompany.com) to the web app. It is not a prerequisite for and does not enable the deployment slots feature.
• D. Incorrect. The 'Always On' feature ensures that the application is always running on one or more instances and doesn't idle out. While this is a useful feature for application responsiveness, it is unrelated to the availability of deployment slots. Enabling 'Always On' does not change the App Service plan's tier or enable the slots feature.

Correct answer: B — contoso-app.azurewebsites.net

• A. Incorrect. A CNAME (Canonical Name) record is used to map a domain name to another canonical domain name, not to an IP address. An 'A' record is used for mapping to an IP address. Furthermore, using the virtual IP is not recommended as it can change, whereas the default hostname is a stable endpoint.
• B. Correct. To map a custom subdomain like `www.contoso.com` to an Azure App Service, the standard method is to create a CNAME record that points to the App Service's default hostname. This hostname follows the format `<app-name>.azurewebsites.net`, which in this case is `contoso-app.azurewebsites.net`.
• C. Incorrect. The `awverify.<custom-domain>` CNAME pointing to `awverify.<app-name>.azurewebsites.net` is a specific record used only for the one-time verification of domain ownership. It is not used for routing live user traffic to the application.
• D. Incorrect. Pointing the CNAME record for `www.contoso.com` to itself would create a circular DNS reference or a loop. This would cause DNS resolution to fail and prevent users from accessing the site.

Correct answer: B — Standard SKU Load Balancer with a zone-redundant frontend.

• A. Incorrect. The Basic SKU Load Balancer does not support Availability Zones. It is not designed for zone-aware or zone-redundant deployments and lacks the high availability and resiliency features required to distribute traffic across instances in multiple zones.
• B. Correct. The Standard SKU Load Balancer is specifically designed to support Availability Zones. Using a zone-redundant frontend creates a single, highly available public IP address that is resilient to zone failures. This configuration allows the load balancer to distribute traffic to the backend pool, which can contain VMSS instances spread across all three specified Availability Zones, meeting the high availability requirements.
• C. Incorrect. While the Standard SKU supports Availability Zones, a zonal frontend ties the public IP address to a single, specific zone (Zone 1 in this case). This creates a single point of failure; if Zone 1 were to experience an outage, the load balancer's frontend would become inaccessible, even if backend instances in other zones are healthy. This does not provide the required cross-zone redundancy.
• D. Incorrect. The Basic SKU Load Balancer does not support any Availability Zone configurations, whether zonal or zone-redundant. This option is fundamentally not possible and cannot meet the requirements.

Correct answer: A — Basic Load Balancer requires all backend VMs to be in the same Availability Set or Scale Set.

• A. This is correct. A fundamental limitation of the Basic Load Balancer is that all virtual machines in its backend pool must belong to a single Availability Set or a single Virtual Machine Scale Set. The operation fails because the two VMs are in different Availability Sets (Availability Set 1 and Availability Set 2). To support VMs from multiple Availability Sets in a backend pool, you must use a Standard Load Balancer.
• B. This is incorrect. The Basic Load Balancer is designed to work with Basic SKU Public IPs. It is the Standard Load Balancer that requires Standard SKU Public IPs. The type of public IP is not the reason for the failure described in the scenario.
• C. This is incorrect. The Basic Load Balancer does support Availability Sets. However, it imposes the restriction that all VMs within the backend pool must be members of the *same* Availability Set. The statement is misleading because it implies no support at all.
• D. This is incorrect. Backend pools for a Basic Load Balancer are typically configured by associating the network interfaces (NICs) of the virtual machines. While IP-based backend pools are a feature of the Standard Load Balancer, they are not a requirement for the Basic Load Balancer, nor is this the cause of the failure.

Correct answer: B — A User-Defined Route (UDR) with next hop type Virtual Appliance

• A. Incorrect. A Network Security Group (NSG) is used for filtering network traffic by allowing or denying it based on rules. It cannot be used to change the routing path or redirect traffic to a virtual appliance. An outbound deny rule would simply block the traffic, not reroute it.
• B. Correct. To override Azure's default routing behavior, you create a Route Table with a User-Defined Route (UDR). This UDR would specify a route for all internet-bound traffic (address prefix 0.0.0.0/0), with the 'next hop type' set to 'Virtual Appliance' and the 'next hop IP address' set to the private IP of the NVA. This route table is then associated with Subnet1, forcing all its outbound internet traffic through the NVA for inspection.
• C. Incorrect. Creating a User-Defined Route (UDR) with the 'next hop type' of 'Internet' would explicitly route traffic from the subnet directly to the internet. This would bypass the NVA, which is the opposite of the stated requirement.
• D. Incorrect. A Service Endpoint Policy is used with Virtual Network service endpoints to control which specific Azure PaaS resources can be accessed. It does not affect subnet routing for general internet traffic or force traffic through an NVA.

Correct answers: A, B, C — Address Prefix: 192.168.10.0/24; Next Hop Type: Virtual Appliance; Next Hop Address: 10.0.1.4

• A. Correct. The Address Prefix is a mandatory field that defines the destination IP address range (in CIDR notation) that the route applies to. All traffic destined for an IP within this prefix will be forwarded according to this route's configuration.
• B. Correct. Since the traffic needs to be routed to a firewall, the Next Hop Type must be set to 'Virtual Appliance'. This type is used when directing traffic to a Network Virtual Appliance (NVA), such as a firewall or router, within the virtual network.
• C. Correct. When the 'Next Hop Type' is set to 'Virtual Appliance', the 'Next Hop Address' field must be populated with the private IP address of the appliance. This tells Azure where to forward the packets that match the address prefix.
• D. Incorrect. The 'Virtual Network' next hop type is used for traffic destined for the virtual network address space itself, and is typically handled by system routes. It is not used to direct traffic to a specific appliance.
• E. Incorrect. The address prefix should be the destination network (192.168.10.0/24), not the IP address of the appliance. Using the appliance's IP as the prefix would only match traffic destined for the appliance itself, not the traffic that needs to be routed through it.
• F. Incorrect. The 'Internet' next hop type directs traffic to the Azure internet gateway for access to the public internet. It is not used for routing traffic to an internal appliance within a virtual network.

Correct answer: B — Standard

• A. Incorrect. The Basic SKU of Azure Bastion only supports connections through the Azure Portal's web-based client. It does not provide the tunneling capabilities required for native RDP or SSH client support from a local computer.
• B. Correct. The Standard SKU is the minimum SKU that adds native client support. This feature allows you to use your local native RDP or SSH client to securely connect to virtual machines through the Bastion service, which fulfills the requirement.
• C. Incorrect. 'Developer' is not a valid SKU for Azure Bastion. The available SKUs include Basic, Standard, and Premium.
• D. Incorrect. While a Premium SKU exists and also supports native client connections, the Standard SKU is the lowest-tier SKU that meets the specified requirement. When answering Azure exam questions, you should select the most cost-effective option that fulfills all requirements.

Correct answer: B — Use the Azure Portal to connect via Bastion over HTTPS (Port 443).

• A. Incorrect. A VPN connection could technically grant access to the virtual network, but it is an overly complex and unnecessary solution when an Azure Bastion host is already deployed. Setting up a VPN involves deploying a VPN gateway and configuring client software, which is a heavier approach than using the purpose-built Bastion service.
• B. Correct. Azure Bastion is specifically designed to provide secure and seamless RDP/SSH access to VMs directly from the Azure portal. The connection is tunneled over HTTPS (port 443), which is typically allowed through corporate firewalls. This directly bypasses the stated problem of outbound port 22 being blocked, and it does so without requiring the VM to have a public IP, enhancing security.
• C. Incorrect. This is an insecure solution. Assigning a public IP address to the VM would expose it to the internet, creating a significant security risk. Furthermore, it fails to solve the root problem, as the developer's corporate firewall would still block the outbound SSH connection on port 22.
• D. Incorrect. Using a load balancer with port forwarding would require a public IP on the load balancer and inbound NAT rules, which exposes a public endpoint to the internet. This also fails to address the outbound firewall restriction on the developer's side and is an unnecessarily complex configuration when Bastion is available.

Correct answer: B — False

• A. The statement is false. The proposed solution will not work because Azure Bastion requires a dedicated subnet with the specific name `AzureBastionSubnet`. A deployment into a subnet named 'BastionSubnet' would fail.
• B. The statement is true. The proposed solution does not meet the goal. A critical prerequisite for deploying Azure Bastion is that it must be placed in a dedicated subnet named exactly `AzureBastionSubnet`. Using any other name, such as 'BastionSubnet', is not supported and will prevent the service from being deployed correctly.

Correct answer: B — Undelete the backup item from the 'Deleted Backup Items' blade

• A. Incorrect. Creating a support ticket is not necessary. The soft delete feature is designed for self-service recovery. Since the deletion occurred within the default 14-day retention period, you can recover the data directly through the Azure portal without involving Microsoft support.
• B. Correct. With soft delete enabled, backup data is retained for a default period of 14 days after deletion. Since only five days have passed, the backup item is in a soft-deleted state. The first and required step to recover the data is to navigate to the 'Deleted Backup Items' blade in the Recovery Services vault and undelete the item for VM1. This action makes the recovery points available for a restore operation.
• C. Incorrect. Disabling the soft delete feature on the vault will not help recover an already deleted item. This action is irrelevant to the recovery process and could lead to the permanent loss of soft-deleted items if not handled correctly. The feature must remain enabled to protect and recover items.
• D. Incorrect. Re-registering the VM to the vault would be for configuring new backups. It does not affect previously deleted backup data. To access the old recovery points, you must first undelete the original backup item.

Correct answer: B — The Recovery Services vault and the Storage Account must be in the same region

• A. Incorrect. The discoverability of a Storage Account in the Azure Backup wizard is not dependent on whether the file share contains data. The backup service lists resources based on compatibility and regional alignment, not the content of the resource.
• B. Correct. A fundamental requirement for Azure Backup is that the Recovery Services vault and the resource to be protected must reside in the same Azure region. Since the Storage Account is in 'East US' and the vault is in 'West US', the backup wizard will not be able to discover the storage account.
• C. Incorrect. Azure File Shares are backed up using a Recovery Services vault. Backup Vaults are used for other services like Azure Disks, Azure Blobs, and Azure Database for PostgreSQL servers, but not for Azure File Shares.
• D. Incorrect. Backing up Azure File Shares is an agentless, native Azure process. The backup service integrates directly with the Azure Storage service to create snapshots. There is no agent to be installed on a Storage Account, which is a PaaS resource.

Correct answer: A — Network Watcher - IP Flow Verify

• A. Correct. Network Watcher IP Flow Verify is the ideal tool for this scenario. It performs a diagnostic check to determine if a packet with specific 5-tuple information (source/destination IP, source/destination port, protocol) is allowed or denied to or from a virtual machine. Crucially, it also identifies the specific Network Security Group (NSG) rule that is allowing or denying the traffic.
• B. Incorrect. Network Watcher Next Hop is used to troubleshoot routing issues, not security rule conflicts. It determines the next hop for outbound traffic from a VM based on the effective routes, helping to identify if traffic is being sent to the correct location (e.g., a virtual appliance or the internet).
• C. Incorrect. Network Watcher Connection Monitor is designed for continuous, long-term monitoring of connectivity and latency between a source (like a VM) and a destination endpoint. While it can detect a connectivity failure, it does not provide an immediate, on-demand diagnosis of the specific NSG rule causing the blockage.
• D. Incorrect. Azure Monitor for Networks (formerly Network Insights) provides a high-level, comprehensive view of network topology, health, and metrics across an entire subscription. It is used for overall network monitoring and gaining insights, not for granular, on-demand troubleshooting of a specific traffic flow against NSG rules.

Correct answer: B — An Alert Processing Rule

• A. Incorrect. An Action Group defines a set of actions to take when an alert is triggered. Creating a new one (e.g., without the SMS action) would be a clumsy workaround, as you would still need to manually modify the alert rule to use the new action group before the maintenance window and then change it back afterward. It does not provide a scheduled suppression capability.
• B. Correct. An Alert Processing Rule (formerly known as an Action Rule) is the feature specifically designed for this scenario. It allows you to apply configurations, such as suppressing notifications, to a set of alerts based on a defined scope, filter, and schedule. You can create a rule to suppress all notifications for the specific VM during the planned maintenance window, and the rule will automatically stop applying after the window ends.
• C. Incorrect. Smart Groups in Azure Monitor use machine learning to automatically group related alerts from different resources to reduce alert noise and aid in troubleshooting. They are used for organizing and correlating fired alerts, not for suppressing notifications during a scheduled maintenance period.
• D. Incorrect. A Metric Chart is a visualization tool within Azure Monitor Metrics Explorer. Its purpose is to plot and analyze metric data over time. It is used for monitoring and analysis, not for controlling or suppressing alert notifications.

Correct answer: D — Azure Monitor Logs query on Storage (Log query on data in blob storage)

• A. Incorrect. Data Export is a mechanism used to send platform logs and metrics to destinations like a storage account for archival or long-term retention. It does not provide a feature to directly query this data in storage using Azure Monitor tools.
• B. Incorrect. Log Analytics Search is used to query data that has already been ingested into a Log Analytics workspace. This option contradicts the requirement to avoid ingestion and its associated costs.
• C. Incorrect. Diagnostic Settings are used to configure the collection and routing of logs and metrics to a destination, such as a storage account, Log Analytics workspace, or Event Hub. It is the configuration step, not the tool used for querying the data.
• D. Correct. This feature allows you to run Kusto Query Language (KQL) queries directly against log data stored in Azure Storage. This meets the requirement of querying logs without ingesting them into a Log Analytics workspace, thereby saving on data ingestion costs.